FIG. 1 depicts a conventional system 10 for allowing end users to access data through a data server. The conventional system 10 includes a conventional middleware server 20, a conventional data server 40, a database 50, and a network 30 connecting the conventional middleware server 20 to the conventional data server 40. End users (not shown) can connect to the conventional middleware server 20, and thus the data server 40, through clients 22, and 24.
FIG. 2 depicts a conventional method 60 for accessing data in the database 50. The conventional method 50 commences after an end user logs onto the conventional middleware server 40. The conventional middleware server 20 requests a connection with the conventional data server 40, via step 62. To do so, the conventional middleware server 20 provides the conventional data server 40 with a user identification for the conventional middleware server 20. The conventional data server 40 validates this user identification for the conventional middleware server 20, via step 64. If the conventional middleware server is authorized to connect to the conventional data server 40, then a connection is established, via step 66. Using this connection, the database 50 can be accessed through the conventional middleware server 20 and returned to end users, via step 68. The connection may be terminated at the end of the session, via step 70.
Although the conventional system 10 and method 60 function, one of ordinary skill in the art will readily recognize that there are significant drawbacks. The use of the database 50 is managed through the connection between the conventional data server 40 and the conventional middleware server 20 established in step 66. However, this connection is established based on the user identification for the conventional middleware server 20. The identity of the end user that is utilizing the database 50 is not tracked. Consequently, there is a loss of end user accountability. Furthermore, because access to the database 50 is managed based upon the user identification of the conventional middleware server 20, that middleware server user ID identification is granted all the privileges required for the actions of all of the end users connecting to the database 50 through the conventional middleware server 20. This results in weakened security since because every end user has access to the same set of privileges on the database 40. For example, all end users of the conventional middleware server 20 may access the same data on the database 40 even though the end user IDs themselves may not otherwise be authorized to access the data. Security for the database 50 is thereby weakened. Alternatively, each time a new end user accesses the database 40 through the conventional middleware server 20, the connection between the conventional middleware server 20 and the data server 40 is re-established based on the identification of the end user. The method 60 is thus repeated and the conventional middleware server 20 re-authenticated each time a new end user desires access to the database 50. Providing new connections for each end user ameliorates the weakening of security discussed above. Furthermore, the connection may allow the end user to obtain only those privileges to which the end user is entitled. However, overhead is greatly increased and performance suffers significantly.
Accordingly, what is needed is an improved mechanism for managing connections between a middleware server and a data server. The present invention addresses such a need.